KR20100073126A - Apparatus and method for detecting malicious code using packed file properties - Google Patents

Abstract

PURPOSE: A malicious code detecting device using execution compression and a method are provided to determine malicious code without execution compression of execution-compressed target file. CONSTITUTION: A PE(Portable Executable) file determination unit(210) inspects PE signature within a file header of inspection target file. A compression method detector(220) detects execution compression possibility and compression method in section header of the file header. A first malicious code determining unit(230) includes the first list storing compression method. The compression method is not used for the malicious code. The first malicious code determining unit determines a malicious code of the file according to existence of the compression method within the first list.

Description

Apparatus and method for detecting malicious code using packed file properties}

The present invention relates to a malicious code detection technology, when the executable executable (PE) file, which is a Windows-based executable file, is compressed, detects a compression method and detects malware using an execution compression characteristic that determines whether the file is malicious code. An apparatus and a method thereof are provided.

The present invention is derived from the research conducted as part of the IT growth engine technology development of the Ministry of Knowledge Economy and the Ministry of Information and Communication Research and Development. [Task management number: 2006-S-042-03, Task name: Countering Zero-Day Attack of Network Threat Development of Real Time Attack Signature Generation and Management Technique

The reason for compressing the execution of malware is to bypass the search of the malware search engine or to prevent the analysis of malware through reverse engineering. The Black Hat 2006 Society reported that 92 percent of Wildlist-registered malware was compressed, and PandaLab's report found that 79 percent of new malware was compressed. In addition, there are statistics that more than 50% of newly appeared malicious codes are compressed by other compression methods. The reason why the compressed malicious code is increased is that the source code of the compression method is disclosed and anyone can easily modify the algorithm or the source code to create various kinds of compression methods.

In general, the malware search engine detects compressed compressed code and performs additional analysis. The executable file before the decompression process can pass the malware signature check, so it must be scanned after the decompression process. Manual decompression requires a lot of time and effort, and automatic decompression requires complex decompression routines for all compression methods, making it very complex and difficult to implement completely.

An object of the present invention is to detect the compression method of the file using the PE header analysis method and the signature analysis method for the detection of malicious code, and then compare the compression method without decompression process to determine the execution compression characteristics to determine whether or not malicious code The present invention provides a malware detection apparatus and method thereof.

The object of the present invention is a PE file determination unit that analyzes a file header of a target file to determine whether the target file is a PE file, and if the target file is a PE file, whether or not to execute compression through section header analysis of the target file. Compression method detection unit for detecting a method, and a first database for indicating whether or not malicious code for each compression method, comprising a comparison of the first database and the compression method, malicious to determine whether the target file malicious code It is achieved by a malware detection apparatus using the execution compression characteristics including a code determination unit.

In addition, a PE file checking step of receiving a target file, and checking whether the target file is a PE file, and if the target file is a PE file, analyzing a section header name and a characteristic item of the target file and detecting a compression method. Detecting a compression method, a malicious code detection step for detecting malicious code compared to the first database that stores the compression method and whether the malicious code for each compression method, and outputting whether the target file malicious code It is achieved by the malware detection method using the execution compression characteristic.

According to the present invention, it is possible to determine whether or not malicious code without decompressing the execution compressed target file. In addition, if the present invention is applied to a search engine to which the existing malware search method is applied, it is possible to increase the speed and accuracy of malware search.

Hereinafter, with reference to the accompanying drawings will be described in detail a preferred embodiment of the present invention.

An apparatus and method for detecting malicious codes using the present compression characteristics are described as follows. First, check the file header of the target file to verify that it is a PE file. If the target file is a PE file, the section header's Name and Characteristic items are examined to detect the compression method used. At this time, if the detected compression method is a compression method for compressing malicious codes, the target file is determined as malicious code. However, if it is not possible to determine the malicious code of the target file only by the compression method, extract MD5 and file size from the target file, and compare the target file with the malicious code compression method, MD5, and the malicious code database. Determine if malicious code

1 is a structural diagram of a PE file which is an executable file of Microsoft.

The PE file is composed of an MS-DOS MZ header 101, an NT header 110 including a PE file header 113 including a PE signature 111 and a PE Optional header 115, a section header 120 and section data. 130.

MS-DOS MZ header 101 is a file header for compatibility with Microsoft's previous operating system, MS-DOS, characterized in that the "MZ" string is present at the beginning of the header.

NT header 110 includes a PE signature 111, a PE file header 113, and a PE Optional header 115.

The PE signature 111 is composed of a string of "PE00", indicating that the file is a PE file. PE signature 111 is characterized in that present in the start position of the NT header (110).

The PE file header 113 includes information on file characteristics, such as the number of sections, the type of executable computer, the last modification time of the file, and the like. The PE Optional header 115 contains information for executing a program, such as an entry point of program code.

The section header 120 is located after the NT header 110, and the NT header 110 includes basic information of the section header. The section header 120 includes information about a section name, section size, and section characteristics of each section.

The section data 130 is located behind the section header 120 and is used as program code or data storage space for each section characteristic.

2 is a block diagram of a malicious code detection apparatus using an execution compression feature that is an embodiment of the present invention.

The malware detection apparatus 200 using the execution compression characteristic includes a PE file detection unit 210, a compression method detection unit 220, a malicious code detection unit 230 and a compression method database 240.

The PE file detection unit 210 checks the header of the target file to see if it starts with the "MZ" string. When the header of the target file starts with "MZ", the PE file detection unit 210 of the target file checks the NT header 110 existing after a certain bit from the start position. The NT header starts with the PE signature 111 and, in the case of a PE file, the NT header 110 with "PE00". The header starts with "MZ" and the PE signature "PE00" string in the NT header indicates that the file is executable on the Microsoft operating system.

The compression method detector 220 includes a section header analyzer 221 and a signature searcher 223.

When the target file is a PE file, the section header analyzer 221 analyzes the section name and the section characteristic information of the section header 120 of the target file to detect a compression method.

Executables generated by common compilers use standard section names. For example, .text, .data, .rsrc, .reloc, .rdata, .idata, CODE, DATA, and so on. However, if the PE file is compressed, use a unique section name for each compression method. For example, the compression method ASPack uses .aspack as the section name, UPX uses UPX0, UPX1, UPX2, Upack uses Upack and Yoda's Crypter yC. Therefore, analyzing the section name can detect the execution compression method.

Also, a section property item is set with a value indicating whether the section can be read, written, or executed. In general, when the executable is compressed, the section property is set to be both writeable and executable because the section must be decompressed when the actual file is executed.

Therefore, by analyzing the section name and the section characteristics, it is possible to detect whether the target file is executed or not and how to compress it.

The signature search unit 223 searches whether a specific string pattern exists in the header of the target file. The general execution compression method leaves a unique fingerprint in the header of the target file, so that the compression method can be detected by detecting it.

The malicious code detection unit 230 compares the compression method detected by the compression method detection unit 220 with the compression method database 240 and checks whether the corresponding file is malicious code.

The compression method database 240 includes a first database 241 storing a compression method of malicious codes, and a second database 243 including a compression method of malicious codes, MD5 of malicious codes, and file sizes of malicious codes. .

The first database 241 stores the compression method into blacklist, whitelist, and graylist. Blacklists include compression methods used to compress malware, and whitelists include commercial compression methods that are not commonly used to compress malware. Compression methods used for malware include Upack, NsPack, Mew, Pex, Yoda's Crypter, PolyCryptPE, and commercial compression methods include Themida, Armadillo, AsProtect, UPX, PeCompact, AsPack, and others. However, in case of both compression methods, they are stored in the gray list, and the compression methods include FSG and Morphine.

In the case of the compression method included in the gray list of the first database 241, it is not possible to determine whether the target file is a malicious code only by comparing with the first database. Therefore, it is finally determined whether or not the target file is malicious code as compared with the second database 243 including the malicious code compression method, MD5, and the size of the malicious code.

MD5 receives the target file, changes it to a 128-bit fixed-length output, and represents a unique value representing the target file.

3 is a flowchart illustrating a malicious code detection method using an execution compression feature that is an embodiment of the present invention.

When the test target file is input to the PE file detection unit 210 (S100), the header of the target file is analyzed to check whether the PE file is present (S101).

If the target file is a PE file, the compression method detection unit 220 analyzes the section header of the target file and extracts the section name and the characteristic item (S103). The compression method detection unit 220 analyzes the extracted section name and characteristic items and detects whether the target file is executed or not and compresses the execution file. However, if the compression method cannot be detected through the analysis of the extracted section name and the characteristic item, the compression method detection unit 220 detects whether the header file of the target file includes a fingerprint unique to the compression method, and detects the compression method. (S105).

When the compression method is detected by the compression method detection unit 220, the malicious code detection unit 230 determines whether or not the malicious code of the file by checking the use of the compression method for malicious code (S107).

When the compression method is detected by the compression method detection unit 220, the malicious code detection unit 230 first checks whether the safe compression method is included in the registered white list (S107). If the target file is included in the whitelist, the target file is determined to be a safe file. If the compression method of the target file is not registered in the white list, it is checked whether the compression method for malicious code is included in the registered black list (S109). If it is included in the blacklist, the target file is determined to be malicious code. If not registered in the black list, it is checked whether the detected compression method is included in the gray list (S111). The compression method registered in the gray list cannot determine whether the target file is malicious code only by the compression method. Therefore, the malware detection unit 230 extracts the MD5 and the file size of the target file (S113). By comparing the MD5 and the file size of the extracted target file with the stored malicious code, it is finally determined whether the malicious code (S115). Finally, the determination result of the malicious code detection unit 230 is output (S117).

While the preferred embodiments of the present invention have been shown and described, the present invention is not limited to the specific embodiments described above, and the present invention is not limited to the specific embodiments of the present invention, without departing from the spirit of the invention as claimed in the claims. Various modifications can be made by those skilled in the art, and these modifications should not be individually understood from the technical spirit or the prospect of the present invention.

1 is a structural diagram of a PE file defined by Microsoft;

2 is a block diagram of a malicious code detection apparatus using execution compression characteristics according to an embodiment of the present invention, and

3 is a flowchart illustrating a malicious code detection method using execution compression characteristics according to an embodiment of the present invention.

Claims (10)

A PE file determination unit that checks whether the file header of the file to be checked includes a PE signature that identifies the PE file; A compression method detection unit for detecting whether or not an execution compression is performed in the section header of the file header when the file header includes the PE signature; And A first malicious code determining unit including a first list storing a compression method not used in malicious code, and determining whether the file is malicious by comparing whether the compression method is included in the first list; Malware detection device using execution compression characteristics. The method of claim 1, The compression method detecting unit extracts a section name and a feature item from the section header, and then checks whether the extracted section name is a section name used in a known compression method, and checks whether the feature item is set to be writeable and executable. And a header analysis detection unit for detecting the compression method. The method of claim 1, The compression method detection unit, the signature detection unit for detecting the compression method by checking whether the file header includes a signature unique to each compression method; malware detection apparatus using the execution compression characteristics further comprising. The method of claim 1, The first malicious code determination unit includes a second list for storing a compression method used only for malicious code, and when the first malicious code determination unit turns out to be an unsafe compression method, the compression method is the second list. And a second malicious code determiner to determine whether the file contains malicious code by comparing the file with a list. The method of claim 4, wherein The first malicious code determination unit includes a third method including a compression method of a malicious code using a compression method not included in the first list or the second list, an MD5 value, and a file size, and the second malicious code. A third malicious code determination unit for determining whether the file is malicious by comparing the compression method, the MD5 value, and the file size of the file when it is not determined as a malicious code by the code determination unit; Malware detection apparatus using the execution compression characteristics further comprising. Checking whether the file header of the file to be checked includes a PE signature that identifies the file as a PE file; Detecting whether a compression method and a compression method are performed in a section header of the file header when the PE header is included in the file header; And And determining whether the file contains malicious code by comparing whether the compression method is included in a first list in which a compression method not used for malicious code is stored. The method of claim 6, When the compression method cannot be detected in the section header, the section name and the feature item are extracted from the section header to compare the section name with the section name used in the known compression method, and the feature item is writable and executable. And detecting the compression method of the file by checking whether the file is set as a malicious code detection method. The method of claim 7, wherein Detecting the compression method by extracting the section name and the characteristic item to determine whether a compression method is included in the section header, and detecting the compression method. Code detection method. The method of claim 6, And determining whether the file is malicious code by comparing whether the compression method is included in a second list storing the compression method used only for malicious code after checking whether the first list is included. Malware detection method using. The method of claim 9, After checking whether the second list is included, the method of compressing the target file, the MD5 value and the file size of the malicious code compressed by the compression method not included in the first or second list, the MD5 value and the file size Determining whether the file is malicious code by comparing whether the file is included in the third list including a malicious code.

Images